Remote nsec TimeStamps using PF_RING and cPacket Devices

PF_RING supports nsec timestamps from some modern NICs, such as those based on the Intel 82580 (e.g. Silicom PE2G4i80). But NIC timestamps require installing and running the application on the machine where the adapter is installed.
Furthermore, by the time the traffic gets from the wire to the the NIC, its temporal behavior might have been altered by queuing, buffering, and switching caused by SPAN ports or aggregation devices.

The hardware time stamp is snapped by the cPacket inline probe, directly at the wire as soon as the packet data hits the physical interface. The cPacket probe augments the original packet with the hardware time stamp, by attaching it to to the end of the Ethernet frame (extra 12 bytes) as follows:

PF_RING has been extended to recognize cPacket timestamps, strip them off to recover the original packet, and set the kernel data structures (skbuff). This means that these “hardware timestamps directly from the wire” can be seamlessly available for any user space applications.

To demonstrate this technology out of the box, we created a software
package (cpacket_ts.tgz) that contains:

n2disk, packet-to-disk application that can efficiently dump packets on disk in pcap format, which includes the accurate hardware time stamp in common pcap file, which can be used by other applications like Wireshark.

The source code used to generate the package (beside the unreleased n2disk application) is part of the PF_RING project.